Owen Flowers, 18, and Thalha Jubair, 20, have been every sentenced to 5 and a half years at Woolwich Crown Court docket on Thursday, 16 July 2026, for the 2024 hack of Transport for London.
The assault left 148 TfL programs inoperable and compelled all 27,000 of the transport authority’s workers into an workplace to get their passwords reset in particular person. Each the NCA and the CPS put TfL’s losses and restoration prices at £29 million.
Each pleaded responsible on 22 June 2026, the day their trial was because of begin. The cost was Part 3ZA of the Pc Misuse Act 1990, the Act’s most severe, they usually admitted it on the idea that they have been reckless as to whether or not they triggered or created a big danger of great harm to human welfare.
The CPS says Flowers and Jubair are believed to be the primary hackers efficiently prosecuted below Part 3ZA. The NCA counts the case as solely the second prosecution of its type. The 2 readings can sit collectively, one counting prosecutions introduced below the part and the opposite counting those who resulted in conviction, however neither company explains the hole.
The NCA calls it the largest cybercrime prosecution the UK courts have seen.
The intrusion ran from 31 August to three September 2024. TfL oversees a median of 9 million journeys a day. Dial-a-Trip, the reserving service that will get weak Londoners across the metropolis, went down, together with the digital funds channel and the issuing of concessionary journey playing cards.
Functions closed for Oyster photocards, the discounted fare playing cards for London’s youngsters and younger individuals. The extension of contactless ticketing slipped, and refunds crawled.
TfL informed prospects that names and e mail addresses had been accessed, together with dwelling addresses the place it held them. Oyster refund information could have gone too, together with checking account numbers and type codes for round 5,000 individuals.
Solely the 2 of them knew what they meant to do with the entry, the CPS says, although their chats urged they might wipe the entry on the best way out. That’s the place the case’s largest quantity comes from: the NCA says a profitable shutdown of the community may have price the UK financial system as much as £56 billion, and the CPS places the identical hypothetical at billions. It stayed hypothetical, the CPS says, as a result of TfL pulled its personal community right down to comprise them.
Flowers was arrested at dwelling on 6 September 2024, three days after the TfL intrusion ended, and the NCA says officers discovered him mid-attack on two US healthcare organisations, SSM Well being Care Company and Sutter Well being.
Investigators seized laptops, tower computer systems, exhausting drives, and USB sticks. One laptop computer held a screenshot of community connectivity to TfL infrastructure, plus movies Flowers had recorded of Jubair transferring by means of TfL programs in the course of the assault. The pair have been messaging on Telegram whereas it occurred and sharing a web-based workspace.
Prosecutors proved Flowers had been related to the distant server used to launch all three intrusions, and his personal gadgets linked him to all three. The knowledge linking Jubair to TfL was uncovered abroad, obtained with assist from prosecutors there.
Flowers admitted two additional counts over the healthcare assaults, a conspiracy in opposition to SSM Well being, and an try in opposition to Sutter Well being. The CPS says he threatened to lock these programs down whereas acknowledging in chats that it “may kill some 90-year-old on life assist.” The arrest is what stopped him.
The NCA describes each males as main members of Scattered Spider, the extortion crew additionally tracked as Octo Tempest, UNC3944, and 0ktapus. The CPS is extra cautious, saying the defendants claimed at varied factors to be members of a gaggle that prosecutors consider carried out a whole lot of assaults between 2022 and 2025.
The FBI, quoted within the NCA’s announcement, ties the group to information extortion, SIM swapping, and social engineering.
Jubair’s different case continues to be open
A grievance unsealed in New Jersey in September 2025 accuses Jubair of laptop fraud, wire fraud, and cash laundering conspiracies. The grievance places the scheme at roughly 120 community intrusions and a minimum of 47 US victims between Could 2022 and September 2025, with greater than $115 million paid in ransoms.
Prosecutors additionally place him in intrusions at a US important infrastructure firm and the US Courts, and allege he moved about $8.4 million in cryptocurrency out of a server pockets whereas brokers have been seizing it. These are allegations, untested in courtroom. The utmost throughout all counts is 95 years. Neither the DOJ’s announcement nor Thursday’s UK releases deal with extradition.
Is Scattered Spider completed?
The NCA says its motion in opposition to the 2 males successfully halted the group, and cites Microsoft’s evaluation that the arrests materially degraded the group’s capacity to function. In the identical breath, it grants that different criminals could maintain utilizing the model.
Scattered Spider is just not the one model with life left in it. In January, Mandiant tracked an growth of ShinyHunters-branded extortion working the identical form of social engineering: vishing calls to workers, victim-branded credential harvesting pages to seize SSO logins and MFA codes, then the attacker’s personal machine enrolled for MFA.
Neither the NCA’s nor the CPS’s written releases set out how Flowers and Jubair first acquired into TfL. Google’s hardening steerage from the identical analysis places the repair in a single place: confirm identification on password resets, machine enrollment, and MFA adjustments, the handbook workflows these crews name in and discuss their means by means of.
Paul Foster, who heads the NCA’s Nationwide Cyber Crime Unit, desires one factor from everybody else: name regulation enforcement early. He says these convictions most likely wouldn’t have occurred if TfL had not.
Metropolis of London Police used the sentencing to foyer for an influence it doesn’t have. Cyber Crime Danger Orders would let a courtroom limit a person’s gadgets, on-line providers and applied sciences in proportion to the danger they pose.
Commander Ollie Shaw pitched them as a “digital jail” for offenders. So the toolkit is what it was: a jail time period, this time handed to 2 individuals who have been 17 and 18 once they did it.
